 | 1 | initial version |
The pcap has already been deleted. This is normal when the packet is truncated/sliced before it is sent to the sniffer.
The IPv4 checksum should pass because the CRC is for IPv4 header bits.
This is the math 1. Look at the bytes on the wire and bytes captured 2. Add all the layer 2 + IPv4 length bytes together
If step 2 is greater than 1, the packet was sliced.
An example of 100 ping 1. 142 bytes on the wire 2. 14 bytes MAC (12-byte MAC + 2-byte TYPE) + 128 bytes IPv4 length (20-byte IPv4 header+8-byte ICMP header + 100-byte payload) or 142 bytes.
If they are different then Wireshark reports length error.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
